@dotenvx/dotenvx 1.75.0 → 2.0.0

package/src/lib/services/genexample.js

@@ -3,8 +3,19 @@ const path = require('path')
 
 const Errors = require('../helpers/errors')
 const findEnvFiles = require('../helpers/findEnvFiles')
-const replace = require('../helpers/replace')
-const dotenvParse = require('../helpers/dotenvParse')
+const { scan, upsert } = require('@dotenvx/primitives')
+
+function finalValues (src) {
+  const { parsed } = scan(src)
+  const result = {}
+
+  for (const key in parsed) {
+    const values = parsed[key]
+    result[key] = values[values.length - 1]
+  }
+
+  return result
+}
 
 class Genexample {
   constructor (directory = '.', envFile) {
@@ -26,7 +37,7 @@ class Genexample {
     /** @type {Record<string, string>} */
     const injected = {}
     /** @type {Record<string, string>} */
-    const preExisted = {}
+    const existed = {}
 
     let exampleSrc = `# ${this.exampleFilename} - generated with dotenvx\n`
 
@@ -40,13 +51,13 @@ class Genexample {
 
       // get the original src
       let src = fsx.readFileXSync(filepath)
-      const parsed = dotenvParse(src)
+      const parsed = finalValues(src)
       for (const key in parsed) {
         // used later
         keys.add(key)
 
         // once newSrc is built write it out
-        src = replace(src, key, '') // empty value
+        src = upsert(src, key, '') // empty value
       }
 
       exampleSrc += `\n${src}`
@@ -65,10 +76,10 @@ class Genexample {
       // it already exists (which means the user might have it modified a way in which they prefer, so replace exampleSrc with their existing .env.example)
       exampleSrc = fsx.readFileXSync(this.exampleFilepath)
 
-      const parsed = dotenvParse(exampleSrc)
+      const parsed = finalValues(exampleSrc)
       for (const key of [...keys]) {
         if (key in parsed) {
-          preExisted[key] = parsed[key]
+          existed[key] = parsed[key]
         } else {
           exampleSrc += `${key}=''\n`
 
@@ -85,7 +96,7 @@ class Genexample {
       exampleFilepath: this.exampleFilepath,
       addedKeys: [...addedKeys],
       injected,
-      preExisted
+      existed
     }
   }
 

package/src/lib/services/login.js

@@ -1,5 +1,6 @@
 const Session = require('../../db/session')
 const PostOauthDeviceCode = require('../api/postOauthDeviceCode')
+const PostOauthToken = require('../api/postOauthToken')
 
 class Login {
   constructor (hostname) {
@@ -21,6 +22,30 @@ class Login {
       interval: data.interval
     }
   }
+
+  async poll (deviceCode, interval) {
+    const sesh = new Session()
+
+    while (true) {
+      try {
+        const data = await new PostOauthToken(this.hostname, deviceCode).run()
+
+        if (data.access_token) {
+          sesh.login(this.hostname, data.id, data.username, data.access_token)
+          await sesh.notifyUpdate()
+          return data
+        }
+
+        await new Promise(resolve => setTimeout(resolve, interval * 1000))
+      } catch (error) {
+        if (error.code === 'authorization_pending') {
+          await new Promise(resolve => setTimeout(resolve, (interval + 1) * 1000))
+        } else {
+          throw error
+        }
+      }
+    }
+  }
 }
 
 module.exports = Login

package/src/lib/services/prebuild.js

@@ -3,10 +3,10 @@ const fsx = require('./../helpers/fsx')
 const path = require('path')
 const ignore = require('ignore')
 
-const Ls = require('../services/ls')
+const ls = require('../resolvers/ls')
 const Errors = require('../helpers/errors')
+const { sealed } = require('@dotenvx/primitives')
 
-const isFullyEncrypted = require('./../helpers/isFullyEncrypted')
 const MISSING_DOCKERIGNORE = '.env.keys' // by default only ignore .env.keys. all other .env* files COULD be included - as long as they are encrypted
 
 class Prebuild {
@@ -35,8 +35,7 @@ class Prebuild {
 
     // 2. check .env* files against .dockerignore file
     const ig = ignore().add(dockerignore)
-    const lsService = new Ls(this.directory, undefined, this.excludeEnvFile)
-    const dotenvFiles = lsService.run()
+    const dotenvFiles = this._filepaths()
     dotenvFiles.forEach(_file => {
       count += 1
 
@@ -54,7 +53,7 @@ class Prebuild {
       } else {
         if (file !== '.env.example' && file !== '.env.x') {
           const src = fsx.readFileXSync(file)
-          const encrypted = isFullyEncrypted(src)
+          const encrypted = sealed(src)
 
           // if contents are encrypted don't raise an error
           if (!encrypted) {
@@ -81,6 +80,13 @@ class Prebuild {
       warnings
     }
   }
+
+  _filepaths () {
+    return ls({
+      directory: this.directory,
+      excludeEnvFile: this.excludeEnvFile
+    })
+  }
 }
 
 module.exports = Prebuild

package/src/lib/services/precommit.js

@@ -3,9 +3,9 @@ const fsx = require('./../helpers/fsx')
 const path = require('path')
 const ignore = require('ignore')
 
-const Ls = require('../services/ls')
+const ls = require('../resolvers/ls')
+const { sealed } = require('@dotenvx/primitives')
 
-const isFullyEncrypted = require('./../helpers/isFullyEncrypted')
 const InstallPrecommitHook = require('./../helpers/installPrecommitHook')
 const Errors = require('./../helpers/errors')
 const childProcess = require('child_process')
@@ -49,8 +49,7 @@ class Precommit {
       // 2. check .env* files against .gitignore file
       const ig = ignore().add(gitignore)
 
-      const lsService = new Ls(this.directory, undefined, this.excludeEnvFile)
-      const dotenvFiles = lsService.run()
+      const dotenvFiles = this._filepaths()
       dotenvFiles.forEach(_file => {
         count += 1
 
@@ -70,7 +69,7 @@ class Precommit {
           } else {
             if (file !== '.env.example' && file !== '.env.x') {
               const src = fsx.readFileXSync(file)
-              const encrypted = isFullyEncrypted(src)
+              const encrypted = sealed(src)
 
               // if contents are encrypted don't raise an error
               if (!encrypted) {
@@ -100,6 +99,13 @@ class Precommit {
     }
   }
 
+  _filepaths () {
+    return ls({
+      directory: this.directory,
+      excludeEnvFile: this.excludeEnvFile
+    })
+  }
+
   _isInGitRepo () {
     try {
       childProcess.execSync('git rev-parse --is-inside-work-tree', { stdio: 'ignore' })

package/src/lib/transforms/decrypt.js

@@ -0,0 +1,83 @@
+const fsx = require('./../helpers/fsx')
+const path = require('path')
+const { parse, upsert } = require('@dotenvx/primitives')
+
+const TYPE_ENV_FILE = 'envFile'
+
+const Errors = require('./../helpers/errors')
+const { determine } = require('./../helpers/envResolution')
+const detectEncoding = require('./../helpers/detectEncoding')
+const providers = require('./../providers')
+
+function parseError (error) {
+  return new Errors({
+    code: error.code,
+    message: error.message,
+    help: error.help
+  }).custom()
+}
+
+async function decrypt (options = {}) {
+  const envs = options.envs || []
+  const ik = options.ik
+  const ek = options.ek
+  const fk = options.fk
+  const provider = options.noArmor ? null : await providers(options)
+
+  const processedEnvs = []
+  const changedFilepaths = []
+  const unchangedFilepaths = []
+
+  for (const env of determine(envs, process.env)) {
+    if (env.type !== TYPE_ENV_FILE) {
+      continue
+    }
+
+    const envFilepath = env.envFilepath || env.value
+    const filepath = env.filepath || path.resolve(envFilepath)
+    const row = { keys: [], type: TYPE_ENV_FILE, filepath, envFilepath, changed: false }
+
+    try {
+      const encoding = await detectEncoding(filepath)
+      row.envSrc = await fsx.readFileX(filepath, { encoding })
+
+      const { parsed, errors } = await parse(row.envSrc, { fk, ik, ek, array: true, provider })
+
+      if (errors.length > 0) {
+        row.error = parseError(errors[0])
+      }
+
+      for (const [key, values] of Object.entries(parsed)) {
+        const before = row.envSrc
+        const after = upsert(before, key, values)
+        if (after !== before) {
+          row.envSrc = after
+          row.changed = true
+          row.keys.push(key)
+        }
+      }
+
+      if (row.changed) {
+        changedFilepaths.push(envFilepath)
+      } else {
+        unchangedFilepaths.push(envFilepath)
+      }
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        row.error = new Errors({ envFilepath, filepath }).missingEnvFile()
+      } else {
+        row.error = error
+      }
+    }
+
+    processedEnvs.push(row)
+  }
+
+  return {
+    processedEnvs,
+    changedFilepaths,
+    unchangedFilepaths
+  }
+}
+
+module.exports = decrypt

package/src/lib/transforms/encrypt.js

@@ -0,0 +1,179 @@
+const fsx = require('./../helpers/fsx')
+const path = require('path')
+const { encrypted, encrypt, scan, upsert, publickeys, keypair } = require('@dotenvx/primitives')
+
+const TYPE_ENV_FILE = 'envFile'
+const SAMPLE_ENV_KIT = require('../helpers/kits/sample')
+
+const Errors = require('../helpers/errors')
+const { determine } = require('./../helpers/envResolution')
+const detectEncoding = require('./../helpers/detectEncoding')
+const { isPublicKey, mutateSrc, mutateKeysSrc } = require('../helpers/cryptography')
+const keynames = require('../conventions/keynames')
+const PostArmorUp = require('../api/postArmorUp')
+const prompts = require('../helpers/prompts')
+const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
+const Session = require('../../db/session')
+
+async function selectKeyStorage () {
+  const selected = await prompts.select({
+    message: 'Choose private key storage',
+    choices: [
+      { name: '◫ File (.env.keys)', value: 'file' },
+      { name: '⛨ Armor (armor.dotenvx.com)', value: 'armored' }
+    ]
+  }, {
+    input: process.stdin,
+    output: process.stderr
+  })
+
+  return selected
+}
+
+async function encryptTransform (options = {}) {
+  const envs = options.envs || []
+  const ik = options.ik
+  const ek = options.ek
+  const fk = options.fk || '.env.keys'
+  let noArmor = options.noArmor // key storage selector below
+  const noCreate = options.noCreate
+
+  const processedEnvs = []
+  const changedFilepaths = []
+  const unchangedFilepaths = []
+
+  // set up keysSrc
+  let keysSrc
+  if (await fsx.exists(fk)) {
+    const encoding = await detectEncoding(fk)
+    keysSrc = await fsx.readFileX(fk, { encoding })
+  }
+
+  for (const env of determine(envs, process.env)) {
+    if (env.type !== TYPE_ENV_FILE) {
+      continue
+    }
+
+    const envFilepath = env.envFilepath || env.value
+    const filepath = env.filepath || path.resolve(envFilepath)
+    const row = { keys: [], type: TYPE_ENV_FILE, filepath, envFilepath, changed: false }
+
+    try {
+      const fileExists = await fsx.exists(filepath)
+      if (!fileExists && !noCreate) {
+        row.envSrc = SAMPLE_ENV_KIT
+        row.changed = true
+      } else {
+        const encoding = await detectEncoding(filepath)
+        row.envSrc = await fsx.readFileX(filepath, { encoding })
+      }
+
+      if (row.envSrc.trim().length === 0) {
+        row.envSrc = SAMPLE_ENV_KIT
+        row.changed = true
+      }
+
+      let publicKey = publickeys(row.envSrc)[0]
+
+      if (!publicKey) {
+        if (!noCreate && !noArmor && selectKeyStorage) {
+          noArmor = await selectKeyStorage() !== 'armored'
+        }
+
+        // upsert public key to .env file
+        const kp = keypair() // local
+        publicKey = kp.publicKey
+        const privateKey = kp.privateKey
+        const { publicKeyName, privateKeyName } = keynames(envFilepath)
+        const { envSrc } = mutateSrc({ envSrc: row.envSrc, envFilepath, keysFilepath: fk, publicKeyName, publicKeyValue: publicKey })
+        row.envSrc = envSrc
+
+        const comment = path.basename(envFilepath)
+
+        if (noArmor) {
+          const mutated = mutateKeysSrc({ keysSrc, privateKeyName, privateKeyValue: privateKey, comment })
+          keysSrc = mutated.keysSrc
+        } else {
+          const sesh = new Session()
+          const hostname = sesh.hostname()
+          const token = sesh.token()
+          const devicePublicKey = sesh.devicePublicKey()
+
+          try {
+            await new PostArmorUp(hostname, token, devicePublicKey, publicKey, privateKey, undefined).run()
+          } catch (error) {
+            if (error.code !== 'DOTENVX_TEAM_REQUIRED') {
+              throw error
+            }
+
+            const choices = teamChoicesFromMeta(error.meta)
+
+            let team = choices[0].value
+            if (choices.length > 1) {
+              team = await prompts.select({
+                message: 'Select team',
+                choices
+              }, {
+                input: process.stdin,
+                output: process.stderr
+              })
+            }
+
+            await new PostArmorUp(hostname, token, devicePublicKey, publicKey, privateKey, team).run()
+          }
+
+          // don't set keysSrc (in armor)
+        }
+      }
+
+      const { parsed } = scan(row.envSrc, { ik, ek })
+
+      for (const [key, values] of Object.entries(parsed)) {
+        // skip if public key
+        if (isPublicKey(key)) {
+          continue
+        }
+
+        const transformedValues = []
+        for (const value of values) {
+          if (encrypted(value)) {
+            transformedValues.push(value) // unchanged
+          } else {
+            const encryptedValue = encrypt(publicKey, value)
+            transformedValues.push(encryptedValue)
+          }
+        }
+
+        const before = row.envSrc
+        row.envSrc = upsert(row.envSrc, key, transformedValues)
+        if (row.envSrc !== before) {
+          row.changed = true
+          row.keys.push(key)
+        }
+      }
+
+      if (row.changed) {
+        changedFilepaths.push(envFilepath)
+      } else {
+        unchangedFilepaths.push(envFilepath)
+      }
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        row.error = new Errors({ envFilepath, filepath }).missingEnvFile()
+      } else {
+        row.error = error
+      }
+    }
+
+    processedEnvs.push(row)
+  }
+
+  return {
+    keysSrc,
+    processedEnvs,
+    changedFilepaths,
+    unchangedFilepaths
+  }
+}
+
+module.exports = encryptTransform

package/src/lib/transforms/set.js

@@ -0,0 +1,179 @@
+const fsx = require('./../helpers/fsx')
+const path = require('path')
+const { encrypt, upsert, publickeys, keypair } = require('@dotenvx/primitives')
+
+const TYPE_ENV_FILE = 'envFile'
+
+const getResolver = require('./../resolvers/get')
+const { determine } = require('./../helpers/envResolution')
+const detectEncoding = require('./../helpers/detectEncoding')
+const { mutateSrc, mutateKeysSrc } = require('../helpers/cryptography')
+const keynames = require('../conventions/keynames')
+const Errors = require('../helpers/errors')
+const PostArmorUp = require('../api/postArmorUp')
+const prompts = require('../helpers/prompts')
+const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
+const Session = require('../../db/session')
+
+async function selectKeyStorage () {
+  const selected = await prompts.select({
+    message: 'Choose private key storage',
+    choices: [
+      { name: '◫ File (.env.keys)', value: 'file' },
+      { name: '⛨ Armor (armor.dotenvx.com)', value: 'armored' }
+    ]
+  }, {
+    input: process.stdin,
+    output: process.stderr
+  })
+
+  return selected
+}
+
+async function setTransform (options = {}) {
+  const envs = options.envs || []
+  const key = options.key
+  const value = options.value
+  const fk = options.fk || '.env.keys'
+  let noArmor = options.noArmor // key storage selector below
+  const noCreate = options.noCreate
+  const noEncrypt = !options.encrypt
+
+  const processedEnvs = []
+  const changedFilepaths = []
+  const unchangedFilepaths = []
+
+  // set up keysSrc
+  let keysSrc
+  if (await fsx.exists(fk)) {
+    const encoding = await detectEncoding(fk)
+    keysSrc = await fsx.readFileX(fk, { encoding })
+  }
+
+  for (const env of determine(envs, process.env)) {
+    if (env.type !== TYPE_ENV_FILE) {
+      continue
+    }
+
+    const envFilepath = env.envFilepath || env.value
+    const filepath = env.filepath || path.resolve(envFilepath)
+    const row = { key, value, type: TYPE_ENV_FILE, filepath, envFilepath, changed: false }
+
+    try {
+      const fileExists = await fsx.exists(filepath)
+      if (!fileExists && !noCreate) {
+        row.envSrc = ''
+        row.changed = true
+      } else {
+        const encoding = await detectEncoding(filepath)
+        row.envSrc = await fsx.readFileX(filepath, { encoding })
+      }
+
+      if (row.envSrc.trim().length === 0) {
+        row.envSrc = ''
+        row.changed = true
+      }
+
+      let publicKey = publickeys(row.envSrc)[0]
+
+      // only create if missing public key and encryption needed
+      if (!publicKey && !noEncrypt) {
+        if (!noCreate && !noArmor && selectKeyStorage) {
+          noArmor = await selectKeyStorage() !== 'armored'
+        }
+
+        // upsert public key to .env file
+        const kp = keypair() // local
+        publicKey = kp.publicKey
+        const privateKey = kp.privateKey
+        const { publicKeyName, privateKeyName } = keynames(envFilepath)
+        const { envSrc } = mutateSrc({ envSrc: row.envSrc, envFilepath, keysFilepath: fk, publicKeyName, publicKeyValue: publicKey })
+        row.envSrc = envSrc
+
+        const comment = path.basename(envFilepath)
+
+        if (noArmor) {
+          const mutated = mutateKeysSrc({ keysSrc, privateKeyName, privateKeyValue: privateKey, comment })
+          keysSrc = mutated.keysSrc
+        } else {
+          const sesh = new Session()
+          const hostname = sesh.hostname()
+          const token = sesh.token()
+          const devicePublicKey = sesh.devicePublicKey()
+
+          try {
+            await new PostArmorUp(hostname, token, devicePublicKey, publicKey, privateKey, undefined).run()
+          } catch (error) {
+            if (error.code !== 'DOTENVX_TEAM_REQUIRED') {
+              throw error
+            }
+
+            const choices = teamChoicesFromMeta(error.meta)
+
+            let team = choices[0].value
+            if (choices.length > 1) {
+              team = await prompts.select({
+                message: 'Select team',
+                choices
+              }, {
+                input: process.stdin,
+                output: process.stderr
+              })
+            }
+
+            await new PostArmorUp(hostname, token, devicePublicKey, publicKey, privateKey, team).run()
+          }
+
+          // don't set keysSrc (in armor)
+        }
+      }
+
+      if (noEncrypt) {
+        const before = row.envSrc
+        row.envSrc = upsert(row.envSrc, key, value)
+        if (row.envSrc !== before) {
+          row.changed = true
+        }
+      } else {
+        // expensive additional loop
+        const { parsed } = await getResolver({
+          key,
+          envs: [env],
+          all: true,
+          envKeysFile: fk,
+          noArmor
+        })
+
+        const before = parsed[key]
+        if (value !== before) {
+          const encryptedValue = encrypt(publicKey, value)
+          row.envSrc = upsert(row.envSrc, key, encryptedValue)
+          row.changed = true
+        }
+      }
+
+      if (row.changed) {
+        changedFilepaths.push(envFilepath)
+      } else {
+        unchangedFilepaths.push(envFilepath)
+      }
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        row.error = new Errors({ envFilepath, filepath }).missingEnvFile()
+      } else {
+        row.error = error
+      }
+    }
+
+    processedEnvs.push(row)
+  }
+
+  return {
+    keysSrc,
+    processedEnvs,
+    changedFilepaths,
+    unchangedFilepaths
+  }
+}
+
+module.exports = setTransform

package/src/shared/logger.js

@@ -4,6 +4,7 @@ const { getColor, bold } = require('./colors')
 
 const levels = {
   error: 0,
+  infoerror: 0,
   warn: 1,
   success: 2,
   successv: 2,
@@ -15,6 +16,7 @@ const levels = {
 }
 
 const error = (m) => bold(getColor('red')(`☠ ${m}`))
+const infoerror = getColor('gray') // actually an error
 const warn = (m) => getColor('orangered')(`⚠ ${m}`)
 const success = getColor('amber')
 const successv = (m) => getColor('amber')(`⟐ ${m}`)
@@ -50,6 +52,8 @@ function formatMessage (level, message) {
     // errors
     case 'error':
       return error(formattedMessage)
+    case 'infoerror':
+      return infoerror(formattedMessage)
     // warns
     case 'warn':
       return warn(formattedMessage)
@@ -79,6 +83,7 @@ const logger = {
 
   // errors
   error: (msg) => stderr('error', msg),
+  infoerror: (msg) => stderr('infoerror', msg),
   // warns
   warn: (msg) => stdout('warn', msg),
   // success

package/src/cli/actions/normalizeArmorOptions.js

@@ -1,10 +0,0 @@
-function normalizeArmorOptions (options) {
-  if (options.armor === false || options.ops === false) {
-    options.armor = false
-    options.ops = false
-  }
-
-  return options
-}
-
-module.exports = normalizeArmorOptions